projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix refcount balance for hci connection
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
1da177e4
LT		 45#include <net/sock.h>
46
47#include <asm/system.h>
70f23020 48#include <linux/uaccess.h>
1da177e4
LT		 49#include <asm/unaligned.h>
50
51#include <net/bluetooth/bluetooth.h>
52#include <net/bluetooth/hci_core.h>
53
ab81cbf9
JH		 54#define AUTO_OFF_TIMEOUT 2000
55
1da177e4
LT		 56static void hci_cmd_task(unsigned long arg);
57static void hci_rx_task(unsigned long arg);
58static void hci_tx_task(unsigned long arg);
59static void hci_notify(struct hci_dev *hdev, int event);
60
61static DEFINE_RWLOCK(hci_task_lock);
62
63/* HCI device list */
64LIST_HEAD(hci_dev_list);
65DEFINE_RWLOCK(hci_dev_list_lock);
66
67/* HCI callback list */
68LIST_HEAD(hci_cb_list);
69DEFINE_RWLOCK(hci_cb_list_lock);
70
71/* HCI protocols */
72#define HCI_MAX_PROTO 2
73struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75/* HCI notifiers list */
e041c683 76static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 77
78/* ---- HCI notifications ---- */
79
80int hci_register_notifier(struct notifier_block *nb)
81{
e041c683 82 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 83}
84
85int hci_unregister_notifier(struct notifier_block *nb)
86{
e041c683 87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 88}
89
6516455d 90static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 91{
e041c683 92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 93}
94
95/* ---- HCI requests ---- */
96
23bb5763 97void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 98{
23bb5763
JH		 99 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
100
a5040efa
JH		 101 /* If this is the init phase check if the completed command matches
102 * the last init command, and if not just return.
103 */
104 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 105 return;
1da177e4
LT		 106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114static void hci_req_cancel(struct hci_dev *hdev, int err)
115{
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123}
124
125/* Execute request and wait for completion. */
8e87d142 126static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 127 unsigned long opt, __u32 timeout)
1da177e4
LT		 128{
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
149 err = -bt_err(hdev->req_result);
150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
3ff50b79 159 }
1da177e4 160
a5040efa 161 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166}
167
168static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 169 unsigned long opt, __u32 timeout)
1da177e4
LT		 170{
171 int ret;
172
7c6a329e
MH		 173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
1da177e4
LT		 176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182}
183
184static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185{
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
f630cf0d 189 set_bit(HCI_RESET, &hdev->flags);
a9de9248 190 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 191}
192
193static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
194{
b0916ea0 195 struct hci_cp_delete_stored_link_key cp;
1da177e4 196 struct sk_buff *skb;
1ebb9252 197 __le16 param;
89f2783d 198 __u8 flt_type;
1da177e4
LT		 199
200 BT_DBG("%s %ld", hdev->name, opt);
201
202 /* Driver initialization */
203
204 /* Special commands */
205 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 206 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 207 skb->dev = (void *) hdev;
c78ae283 208
1da177e4 209 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 210 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 211 }
212 skb_queue_purge(&hdev->driver_init);
213
214 /* Mandatory initialization */
215
216 /* Reset */
f630cf0d
GP		 217 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
218 set_bit(HCI_RESET, &hdev->flags);
a9de9248 219 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 220 }
1da177e4
LT		 221
222 /* Read Local Supported Features */
a9de9248 223 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 224
1143e5a6 225 /* Read Local Version */
a9de9248 226 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 227
1da177e4 228 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 229 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 230
231#if 0
232 /* Host buffer size */
233 {
234 struct hci_cp_host_buffer_size cp;
aca3192c 235 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 236 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 237 cp.acl_max_pkt = cpu_to_le16(0xffff);
238 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 239 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 240 }
241#endif
242
243 /* Read BD Address */
a9de9248
MH		 244 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
245
246 /* Read Class of Device */
247 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
248
249 /* Read Local Name */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 251
252 /* Read Voice Setting */
a9de9248 253 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 254
255 /* Optional initialization */
256
257 /* Clear Event Filters */
89f2783d 258 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 259 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 260
1da177e4 261 /* Connection accept timeout ~20 secs */
aca3192c 262 param = cpu_to_le16(0x7d00);
a9de9248 263 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 264
265 bacpy(&cp.bdaddr, BDADDR_ANY);
266 cp.delete_all = 1;
267 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 268}
269
6ed58ec5
VT		 270static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
271{
272 BT_DBG("%s", hdev->name);
273
274 /* Read LE buffer size */
275 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
276}
277
1da177e4
LT		 278static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
279{
280 __u8 scan = opt;
281
282 BT_DBG("%s %x", hdev->name, scan);
283
284 /* Inquiry and Page scans */
a9de9248 285 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 286}
287
288static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
289{
290 __u8 auth = opt;
291
292 BT_DBG("%s %x", hdev->name, auth);
293
294 /* Authentication */
a9de9248 295 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 296}
297
298static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
299{
300 __u8 encrypt = opt;
301
302 BT_DBG("%s %x", hdev->name, encrypt);
303
e4e8e37c 304 /* Encryption */
a9de9248 305 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 306}
307
e4e8e37c
MH		 308static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
309{
310 __le16 policy = cpu_to_le16(opt);
311
a418b893 312 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 313
314 /* Default link policy */
315 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
316}
317
8e87d142 318/* Get HCI device by index.
1da177e4
LT		 319 * Device is held on return. */
320struct hci_dev *hci_dev_get(int index)
321{
322 struct hci_dev *hdev = NULL;
323 struct list_head *p;
324
325 BT_DBG("%d", index);
326
327 if (index < 0)
328 return NULL;
329
330 read_lock(&hci_dev_list_lock);
331 list_for_each(p, &hci_dev_list) {
332 struct hci_dev *d = list_entry(p, struct hci_dev, list);
333 if (d->id == index) {
334 hdev = hci_dev_hold(d);
335 break;
336 }
337 }
338 read_unlock(&hci_dev_list_lock);
339 return hdev;
340}
1da177e4
LT		 341
342/* ---- Inquiry support ---- */
343static void inquiry_cache_flush(struct hci_dev *hdev)
344{
345 struct inquiry_cache *cache = &hdev->inq_cache;
346 struct inquiry_entry *next = cache->list, *e;
347
348 BT_DBG("cache %p", cache);
349
350 cache->list = NULL;
351 while ((e = next)) {
352 next = e->next;
353 kfree(e);
354 }
355}
356
357struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
358{
359 struct inquiry_cache *cache = &hdev->inq_cache;
360 struct inquiry_entry *e;
361
362 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
363
364 for (e = cache->list; e; e = e->next)
365 if (!bacmp(&e->data.bdaddr, bdaddr))
366 break;
367 return e;
368}
369
370void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
371{
372 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 373 struct inquiry_entry *ie;
1da177e4
LT		 374
375 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
376
70f23020
AE		 377 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
378 if (!ie) {
1da177e4 379 /* Entry not in the cache. Add new one. */
70f23020
AE		 380 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
381 if (!ie)
1da177e4 382 return;
70f23020
AE		 383
384 ie->next = cache->list;
385 cache->list = ie;
1da177e4
LT		 386 }
387
70f23020
AE		 388 memcpy(&ie->data, data, sizeof(*data));
389 ie->timestamp = jiffies;
1da177e4
LT		 390 cache->timestamp = jiffies;
391}
392
393static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
394{
395 struct inquiry_cache *cache = &hdev->inq_cache;
396 struct inquiry_info *info = (struct inquiry_info *) buf;
397 struct inquiry_entry *e;
398 int copied = 0;
399
400 for (e = cache->list; e && copied < num; e = e->next, copied++) {
401 struct inquiry_data *data = &e->data;
402 bacpy(&info->bdaddr, &data->bdaddr);
403 info->pscan_rep_mode = data->pscan_rep_mode;
404 info->pscan_period_mode = data->pscan_period_mode;
405 info->pscan_mode = data->pscan_mode;
406 memcpy(info->dev_class, data->dev_class, 3);
407 info->clock_offset = data->clock_offset;
408 info++;
409 }
410
411 BT_DBG("cache %p, copied %d", cache, copied);
412 return copied;
413}
414
415static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
416{
417 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
418 struct hci_cp_inquiry cp;
419
420 BT_DBG("%s", hdev->name);
421
422 if (test_bit(HCI_INQUIRY, &hdev->flags))
423 return;
424
425 /* Start Inquiry */
426 memcpy(&cp.lap, &ir->lap, 3);
427 cp.length = ir->length;
428 cp.num_rsp = ir->num_rsp;
a9de9248 429 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 430}
431
432int hci_inquiry(void __user *arg)
433{
434 __u8 __user *ptr = arg;
435 struct hci_inquiry_req ir;
436 struct hci_dev *hdev;
437 int err = 0, do_inquiry = 0, max_rsp;
438 long timeo;
439 __u8 *buf;
440
441 if (copy_from_user(&ir, ptr, sizeof(ir)))
442 return -EFAULT;
443
5a08ecce
AE		 444 hdev = hci_dev_get(ir.dev_id);
445 if (!hdev)
1da177e4
LT		 446 return -ENODEV;
447
448 hci_dev_lock_bh(hdev);
8e87d142 449 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 450 inquiry_cache_empty(hdev) ||
451 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 452 inquiry_cache_flush(hdev);
453 do_inquiry = 1;
454 }
455 hci_dev_unlock_bh(hdev);
456
04837f64 457 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 458
459 if (do_inquiry) {
460 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
461 if (err < 0)
462 goto done;
463 }
1da177e4
LT		 464
465 /* for unlimited number of responses we will use buffer with 255 entries */
466 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
467
468 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
469 * copy it to the user space.
470 */
01df8c31 471 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 472 if (!buf) {
1da177e4
LT		 473 err = -ENOMEM;
474 goto done;
475 }
476
477 hci_dev_lock_bh(hdev);
478 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
479 hci_dev_unlock_bh(hdev);
480
481 BT_DBG("num_rsp %d", ir.num_rsp);
482
483 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
484 ptr += sizeof(ir);
485 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
486 ir.num_rsp))
487 err = -EFAULT;
8e87d142 488 } else
1da177e4
LT		 489 err = -EFAULT;
490
491 kfree(buf);
492
493done:
494 hci_dev_put(hdev);
495 return err;
496}
497
498/* ---- HCI ioctl helpers ---- */
499
500int hci_dev_open(__u16 dev)
501{
502 struct hci_dev *hdev;
503 int ret = 0;
504
5a08ecce
AE		 505 hdev = hci_dev_get(dev);
506 if (!hdev)
1da177e4
LT		 507 return -ENODEV;
508
509 BT_DBG("%s %p", hdev->name, hdev);
510
511 hci_req_lock(hdev);
512
611b30f7
MH		 513 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
514 ret = -ERFKILL;
515 goto done;
516 }
517
1da177e4
LT		 518 if (test_bit(HCI_UP, &hdev->flags)) {
519 ret = -EALREADY;
520 goto done;
521 }
522
523 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
524 set_bit(HCI_RAW, &hdev->flags);
525
943da25d
MH		 526 /* Treat all non BR/EDR controllers as raw devices for now */
527 if (hdev->dev_type != HCI_BREDR)
528 set_bit(HCI_RAW, &hdev->flags);
529
1da177e4
LT		 530 if (hdev->open(hdev)) {
531 ret = -EIO;
532 goto done;
533 }
534
535 if (!test_bit(HCI_RAW, &hdev->flags)) {
536 atomic_set(&hdev->cmd_cnt, 1);
537 set_bit(HCI_INIT, &hdev->flags);
a5040efa 538 hdev->init_last_cmd = 0;
1da177e4 539
04837f64
MH		 540 ret = __hci_request(hdev, hci_init_req, 0,
541 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 542
6ed58ec5
VT		 543 if (lmp_le_capable(hdev))
544 ret = __hci_request(hdev, hci_le_init_req, 0,
545 msecs_to_jiffies(HCI_INIT_TIMEOUT));
546
1da177e4
LT		 547 clear_bit(HCI_INIT, &hdev->flags);
548 }
549
550 if (!ret) {
551 hci_dev_hold(hdev);
552 set_bit(HCI_UP, &hdev->flags);
553 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 554 if (!test_bit(HCI_SETUP, &hdev->flags))
555 mgmt_powered(hdev->id, 1);
8e87d142 556 } else {
1da177e4
LT		 557 /* Init failed, cleanup */
558 tasklet_kill(&hdev->rx_task);
559 tasklet_kill(&hdev->tx_task);
560 tasklet_kill(&hdev->cmd_task);
561
562 skb_queue_purge(&hdev->cmd_q);
563 skb_queue_purge(&hdev->rx_q);
564
565 if (hdev->flush)
566 hdev->flush(hdev);
567
568 if (hdev->sent_cmd) {
569 kfree_skb(hdev->sent_cmd);
570 hdev->sent_cmd = NULL;
571 }
572
573 hdev->close(hdev);
574 hdev->flags = 0;
575 }
576
577done:
578 hci_req_unlock(hdev);
579 hci_dev_put(hdev);
580 return ret;
581}
582
583static int hci_dev_do_close(struct hci_dev *hdev)
584{
585 BT_DBG("%s %p", hdev->name, hdev);
586
587 hci_req_cancel(hdev, ENODEV);
588 hci_req_lock(hdev);
589
b77dcf84
TG		 590 /* Stop timer, it might be running */
591 del_timer_sync(&hdev->cmd_timer);
592
1da177e4
LT		 593 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
594 hci_req_unlock(hdev);
595 return 0;
596 }
597
598 /* Kill RX and TX tasks */
599 tasklet_kill(&hdev->rx_task);
600 tasklet_kill(&hdev->tx_task);
601
602 hci_dev_lock_bh(hdev);
603 inquiry_cache_flush(hdev);
604 hci_conn_hash_flush(hdev);
605 hci_dev_unlock_bh(hdev);
606
607 hci_notify(hdev, HCI_DEV_DOWN);
608
609 if (hdev->flush)
610 hdev->flush(hdev);
611
612 /* Reset device */
613 skb_queue_purge(&hdev->cmd_q);
614 atomic_set(&hdev->cmd_cnt, 1);
615 if (!test_bit(HCI_RAW, &hdev->flags)) {
616 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 617 __hci_request(hdev, hci_reset_req, 0,
618 msecs_to_jiffies(250));
1da177e4
LT		 619 clear_bit(HCI_INIT, &hdev->flags);
620 }
621
622 /* Kill cmd task */
623 tasklet_kill(&hdev->cmd_task);
624
625 /* Drop queues */
626 skb_queue_purge(&hdev->rx_q);
627 skb_queue_purge(&hdev->cmd_q);
628 skb_queue_purge(&hdev->raw_q);
629
630 /* Drop last sent command */
631 if (hdev->sent_cmd) {
632 kfree_skb(hdev->sent_cmd);
633 hdev->sent_cmd = NULL;
634 }
635
636 /* After this point our queues are empty
637 * and no tasks are scheduled. */
638 hdev->close(hdev);
639
5add6af8
JH		 640 mgmt_powered(hdev->id, 0);
641
1da177e4
LT		 642 /* Clear flags */
643 hdev->flags = 0;
644
645 hci_req_unlock(hdev);
646
647 hci_dev_put(hdev);
648 return 0;
649}
650
651int hci_dev_close(__u16 dev)
652{
653 struct hci_dev *hdev;
654 int err;
655
70f23020
AE		 656 hdev = hci_dev_get(dev);
657 if (!hdev)
1da177e4
LT		 658 return -ENODEV;
659 err = hci_dev_do_close(hdev);
660 hci_dev_put(hdev);
661 return err;
662}
663
664int hci_dev_reset(__u16 dev)
665{
666 struct hci_dev *hdev;
667 int ret = 0;
668
70f23020
AE		 669 hdev = hci_dev_get(dev);
670 if (!hdev)
1da177e4
LT		 671 return -ENODEV;
672
673 hci_req_lock(hdev);
674 tasklet_disable(&hdev->tx_task);
675
676 if (!test_bit(HCI_UP, &hdev->flags))
677 goto done;
678
679 /* Drop queues */
680 skb_queue_purge(&hdev->rx_q);
681 skb_queue_purge(&hdev->cmd_q);
682
683 hci_dev_lock_bh(hdev);
684 inquiry_cache_flush(hdev);
685 hci_conn_hash_flush(hdev);
686 hci_dev_unlock_bh(hdev);
687
688 if (hdev->flush)
689 hdev->flush(hdev);
690
8e87d142 691 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 692 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 693
694 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 695 ret = __hci_request(hdev, hci_reset_req, 0,
696 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 697
698done:
699 tasklet_enable(&hdev->tx_task);
700 hci_req_unlock(hdev);
701 hci_dev_put(hdev);
702 return ret;
703}
704
705int hci_dev_reset_stat(__u16 dev)
706{
707 struct hci_dev *hdev;
708 int ret = 0;
709
70f23020
AE		 710 hdev = hci_dev_get(dev);
711 if (!hdev)
1da177e4
LT		 712 return -ENODEV;
713
714 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
715
716 hci_dev_put(hdev);
717
718 return ret;
719}
720
721int hci_dev_cmd(unsigned int cmd, void __user *arg)
722{
723 struct hci_dev *hdev;
724 struct hci_dev_req dr;
725 int err = 0;
726
727 if (copy_from_user(&dr, arg, sizeof(dr)))
728 return -EFAULT;
729
70f23020
AE		 730 hdev = hci_dev_get(dr.dev_id);
731 if (!hdev)
1da177e4
LT		 732 return -ENODEV;
733
734 switch (cmd) {
735 case HCISETAUTH:
04837f64
MH		 736 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
737 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 738 break;
739
740 case HCISETENCRYPT:
741 if (!lmp_encrypt_capable(hdev)) {
742 err = -EOPNOTSUPP;
743 break;
744 }
745
746 if (!test_bit(HCI_AUTH, &hdev->flags)) {
747 /* Auth must be enabled first */
04837f64
MH		 748 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
749 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 750 if (err)
751 break;
752 }
753
04837f64
MH		 754 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
755 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 756 break;
757
758 case HCISETSCAN:
04837f64
MH		 759 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
760 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 761 break;
762
1da177e4 763 case HCISETLINKPOL:
e4e8e37c
MH		 764 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
765 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 766 break;
767
768 case HCISETLINKMODE:
e4e8e37c
MH		 769 hdev->link_mode = ((__u16) dr.dev_opt) &
770 (HCI_LM_MASTER | HCI_LM_ACCEPT);
771 break;
772
773 case HCISETPTYPE:
774 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 775 break;
776
777 case HCISETACLMTU:
e4e8e37c
MH		 778 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
779 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 780 break;
781
782 case HCISETSCOMTU:
e4e8e37c
MH		 783 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
784 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 785 break;
786
787 default:
788 err = -EINVAL;
789 break;
790 }
e4e8e37c 791
1da177e4
LT		 792 hci_dev_put(hdev);
793 return err;
794}
795
796int hci_get_dev_list(void __user *arg)
797{
798 struct hci_dev_list_req *dl;
799 struct hci_dev_req *dr;
800 struct list_head *p;
801 int n = 0, size, err;
802 __u16 dev_num;
803
804 if (get_user(dev_num, (__u16 __user *) arg))
805 return -EFAULT;
806
807 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
808 return -EINVAL;
809
810 size = sizeof(*dl) + dev_num * sizeof(*dr);
811
70f23020
AE		 812 dl = kzalloc(size, GFP_KERNEL);
813 if (!dl)
1da177e4
LT		 814 return -ENOMEM;
815
816 dr = dl->dev_req;
817
818 read_lock_bh(&hci_dev_list_lock);
819 list_for_each(p, &hci_dev_list) {
820 struct hci_dev *hdev;
c542a06c 821
1da177e4 822 hdev = list_entry(p, struct hci_dev, list);
c542a06c 823
ab81cbf9 824 hci_del_off_timer(hdev);
c542a06c
JH		 825
826 if (!test_bit(HCI_MGMT, &hdev->flags))
827 set_bit(HCI_PAIRABLE, &hdev->flags);
828
1da177e4
LT		 829 (dr + n)->dev_id = hdev->id;
830 (dr + n)->dev_opt = hdev->flags;
c542a06c 831
1da177e4
LT		 832 if (++n >= dev_num)
833 break;
834 }
835 read_unlock_bh(&hci_dev_list_lock);
836
837 dl->dev_num = n;
838 size = sizeof(*dl) + n * sizeof(*dr);
839
840 err = copy_to_user(arg, dl, size);
841 kfree(dl);
842
843 return err ? -EFAULT : 0;
844}
845
846int hci_get_dev_info(void __user *arg)
847{
848 struct hci_dev *hdev;
849 struct hci_dev_info di;
850 int err = 0;
851
852 if (copy_from_user(&di, arg, sizeof(di)))
853 return -EFAULT;
854
70f23020
AE		 855 hdev = hci_dev_get(di.dev_id);
856 if (!hdev)
1da177e4
LT		 857 return -ENODEV;
858
ab81cbf9
JH		 859 hci_del_off_timer(hdev);
860
c542a06c
JH		 861 if (!test_bit(HCI_MGMT, &hdev->flags))
862 set_bit(HCI_PAIRABLE, &hdev->flags);
863
1da177e4
LT		 864 strcpy(di.name, hdev->name);
865 di.bdaddr = hdev->bdaddr;
943da25d 866 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 867 di.flags = hdev->flags;
868 di.pkt_type = hdev->pkt_type;
869 di.acl_mtu = hdev->acl_mtu;
870 di.acl_pkts = hdev->acl_pkts;
871 di.sco_mtu = hdev->sco_mtu;
872 di.sco_pkts = hdev->sco_pkts;
873 di.link_policy = hdev->link_policy;
874 di.link_mode = hdev->link_mode;
875
876 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
877 memcpy(&di.features, &hdev->features, sizeof(di.features));
878
879 if (copy_to_user(arg, &di, sizeof(di)))
880 err = -EFAULT;
881
882 hci_dev_put(hdev);
883
884 return err;
885}
886
887/* ---- Interface to HCI drivers ---- */
888
611b30f7
MH		 889static int hci_rfkill_set_block(void *data, bool blocked)
890{
891 struct hci_dev *hdev = data;
892
893 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
894
895 if (!blocked)
896 return 0;
897
898 hci_dev_do_close(hdev);
899
900 return 0;
901}
902
903static const struct rfkill_ops hci_rfkill_ops = {
904 .set_block = hci_rfkill_set_block,
905};
906
1da177e4
LT		 907/* Alloc HCI device */
908struct hci_dev *hci_alloc_dev(void)
909{
910 struct hci_dev *hdev;
911
25ea6db0 912 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 913 if (!hdev)
914 return NULL;
915
1da177e4
LT		 916 skb_queue_head_init(&hdev->driver_init);
917
918 return hdev;
919}
920EXPORT_SYMBOL(hci_alloc_dev);
921
922/* Free HCI device */
923void hci_free_dev(struct hci_dev *hdev)
924{
925 skb_queue_purge(&hdev->driver_init);
926
a91f2e39
MH		 927 /* will free via device release */
928 put_device(&hdev->dev);
1da177e4
LT		 929}
930EXPORT_SYMBOL(hci_free_dev);
931
ab81cbf9
JH		 932static void hci_power_on(struct work_struct *work)
933{
934 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
935
936 BT_DBG("%s", hdev->name);
937
938 if (hci_dev_open(hdev->id) < 0)
939 return;
940
941 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
942 mod_timer(&hdev->off_timer,
943 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
944
945 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
946 mgmt_index_added(hdev->id);
947}
948
949static void hci_power_off(struct work_struct *work)
950{
951 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
952
953 BT_DBG("%s", hdev->name);
954
955 hci_dev_close(hdev->id);
956}
957
958static void hci_auto_off(unsigned long data)
959{
960 struct hci_dev *hdev = (struct hci_dev *) data;
961
962 BT_DBG("%s", hdev->name);
963
964 clear_bit(HCI_AUTO_OFF, &hdev->flags);
965
966 queue_work(hdev->workqueue, &hdev->power_off);
967}
968
969void hci_del_off_timer(struct hci_dev *hdev)
970{
971 BT_DBG("%s", hdev->name);
972
973 clear_bit(HCI_AUTO_OFF, &hdev->flags);
974 del_timer(&hdev->off_timer);
975}
976
2aeb9a1a
JH		 977int hci_uuids_clear(struct hci_dev *hdev)
978{
979 struct list_head *p, *n;
980
981 list_for_each_safe(p, n, &hdev->uuids) {
982 struct bt_uuid *uuid;
983
984 uuid = list_entry(p, struct bt_uuid, list);
985
986 list_del(p);
987 kfree(uuid);
988 }
989
990 return 0;
991}
992
55ed8ca1
JH		 993int hci_link_keys_clear(struct hci_dev *hdev)
994{
995 struct list_head *p, *n;
996
997 list_for_each_safe(p, n, &hdev->link_keys) {
998 struct link_key *key;
999
1000 key = list_entry(p, struct link_key, list);
1001
1002 list_del(p);
1003 kfree(key);
1004 }
1005
1006 return 0;
1007}
1008
1009struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1010{
1011 struct list_head *p;
1012
1013 list_for_each(p, &hdev->link_keys) {
1014 struct link_key *k;
1015
1016 k = list_entry(p, struct link_key, list);
1017
1018 if (bacmp(bdaddr, &k->bdaddr) == 0)
1019 return k;
1020 }
1021
1022 return NULL;
1023}
1024
1025int hci_add_link_key(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1026 u8 *val, u8 type, u8 pin_len)
1027{
1028 struct link_key *key, *old_key;
1029 u8 old_key_type;
1030
1031 old_key = hci_find_link_key(hdev, bdaddr);
1032 if (old_key) {
1033 old_key_type = old_key->type;
1034 key = old_key;
1035 } else {
1036 old_key_type = 0xff;
1037 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1038 if (!key)
1039 return -ENOMEM;
1040 list_add(&key->list, &hdev->link_keys);
1041 }
1042
1043 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1044
1045 bacpy(&key->bdaddr, bdaddr);
1046 memcpy(key->val, val, 16);
1047 key->type = type;
1048 key->pin_len = pin_len;
1049
1050 if (new_key)
1051 mgmt_new_key(hdev->id, key, old_key_type);
1052
1053 if (type == 0x06)
1054 key->type = old_key_type;
1055
1056 return 0;
1057}
1058
1059int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1060{
1061 struct link_key *key;
1062
1063 key = hci_find_link_key(hdev, bdaddr);
1064 if (!key)
1065 return -ENOENT;
1066
1067 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1068
1069 list_del(&key->list);
1070 kfree(key);
1071
1072 return 0;
1073}
1074
6bd32326
VT		 1075/* HCI command timer function */
1076static void hci_cmd_timer(unsigned long arg)
1077{
1078 struct hci_dev *hdev = (void *) arg;
1079
1080 BT_ERR("%s command tx timeout", hdev->name);
1081 atomic_set(&hdev->cmd_cnt, 1);
f630cf0d 1082 clear_bit(HCI_RESET, &hdev->flags);
6bd32326
VT		 1083 tasklet_schedule(&hdev->cmd_task);
1084}
1085
1da177e4
LT		 1086/* Register HCI device */
1087int hci_register_dev(struct hci_dev *hdev)
1088{
1089 struct list_head *head = &hci_dev_list, *p;
ef222013 1090 int i, id = 0;
1da177e4 1091
c13854ce
MH		 1092 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1093 hdev->bus, hdev->owner);
1da177e4
LT		 1094
1095 if (!hdev->open || !hdev->close || !hdev->destruct)
1096 return -EINVAL;
1097
1098 write_lock_bh(&hci_dev_list_lock);
1099
1100 /* Find first available device id */
1101 list_for_each(p, &hci_dev_list) {
1102 if (list_entry(p, struct hci_dev, list)->id != id)
1103 break;
1104 head = p; id++;
1105 }
8e87d142 1106
1da177e4
LT		 1107 sprintf(hdev->name, "hci%d", id);
1108 hdev->id = id;
1109 list_add(&hdev->list, head);
1110
1111 atomic_set(&hdev->refcnt, 1);
1112 spin_lock_init(&hdev->lock);
1113
1114 hdev->flags = 0;
1115 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1116 hdev->esco_type = (ESCO_HV1);
1da177e4 1117 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1118 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1119
04837f64
MH		 1120 hdev->idle_timeout = 0;
1121 hdev->sniff_max_interval = 800;
1122 hdev->sniff_min_interval = 80;
1123
70f23020 1124 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1125 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1126 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1127
1128 skb_queue_head_init(&hdev->rx_q);
1129 skb_queue_head_init(&hdev->cmd_q);
1130 skb_queue_head_init(&hdev->raw_q);
1131
6bd32326
VT		 1132 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1133
cd4c5391 1134 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1135 hdev->reassembly[i] = NULL;
1136
1da177e4 1137 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1138 mutex_init(&hdev->req_lock);
1da177e4
LT		 1139
1140 inquiry_cache_init(hdev);
1141
1142 hci_conn_hash_init(hdev);
1143
ea4bd8ba 1144 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1145
2aeb9a1a
JH		 1146 INIT_LIST_HEAD(&hdev->uuids);
1147
55ed8ca1
JH		 1148 INIT_LIST_HEAD(&hdev->link_keys);
1149
ab81cbf9
JH		 1150 INIT_WORK(&hdev->power_on, hci_power_on);
1151 INIT_WORK(&hdev->power_off, hci_power_off);
1152 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1153
1da177e4
LT		 1154 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1155
1156 atomic_set(&hdev->promisc, 0);
1157
1158 write_unlock_bh(&hci_dev_list_lock);
1159
f48fd9c8
MH		 1160 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1161 if (!hdev->workqueue)
1162 goto nomem;
1163
1da177e4
LT		 1164 hci_register_sysfs(hdev);
1165
611b30f7
MH		 1166 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1167 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1168 if (hdev->rfkill) {
1169 if (rfkill_register(hdev->rfkill) < 0) {
1170 rfkill_destroy(hdev->rfkill);
1171 hdev->rfkill = NULL;
1172 }
1173 }
1174
ab81cbf9
JH		 1175 set_bit(HCI_AUTO_OFF, &hdev->flags);
1176 set_bit(HCI_SETUP, &hdev->flags);
1177 queue_work(hdev->workqueue, &hdev->power_on);
1178
1da177e4
LT		 1179 hci_notify(hdev, HCI_DEV_REG);
1180
1181 return id;
f48fd9c8
MH		 1182
1183nomem:
1184 write_lock_bh(&hci_dev_list_lock);
1185 list_del(&hdev->list);
1186 write_unlock_bh(&hci_dev_list_lock);
1187
1188 return -ENOMEM;
1da177e4
LT		 1189}
1190EXPORT_SYMBOL(hci_register_dev);
1191
1192/* Unregister HCI device */
1193int hci_unregister_dev(struct hci_dev *hdev)
1194{
ef222013
MH		 1195 int i;
1196
c13854ce 1197 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1198
1da177e4
LT		 1199 write_lock_bh(&hci_dev_list_lock);
1200 list_del(&hdev->list);
1201 write_unlock_bh(&hci_dev_list_lock);
1202
1203 hci_dev_do_close(hdev);
1204
cd4c5391 1205 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1206 kfree_skb(hdev->reassembly[i]);
1207
ab81cbf9
JH		 1208 if (!test_bit(HCI_INIT, &hdev->flags) &&
1209 !test_bit(HCI_SETUP, &hdev->flags))
1210 mgmt_index_removed(hdev->id);
1211
1da177e4
LT		 1212 hci_notify(hdev, HCI_DEV_UNREG);
1213
611b30f7
MH		 1214 if (hdev->rfkill) {
1215 rfkill_unregister(hdev->rfkill);
1216 rfkill_destroy(hdev->rfkill);
1217 }
1218
147e2d59
DY		 1219 hci_unregister_sysfs(hdev);
1220
c6f3c5f7
GP		 1221 hci_del_off_timer(hdev);
1222
f48fd9c8
MH		 1223 destroy_workqueue(hdev->workqueue);
1224
e2e0cacb
JH		 1225 hci_dev_lock_bh(hdev);
1226 hci_blacklist_clear(hdev);
2aeb9a1a 1227 hci_uuids_clear(hdev);
55ed8ca1 1228 hci_link_keys_clear(hdev);
e2e0cacb
JH		 1229 hci_dev_unlock_bh(hdev);
1230
1da177e4 1231 __hci_dev_put(hdev);
ef222013 1232
1da177e4
LT		 1233 return 0;
1234}
1235EXPORT_SYMBOL(hci_unregister_dev);
1236
1237/* Suspend HCI device */
1238int hci_suspend_dev(struct hci_dev *hdev)
1239{
1240 hci_notify(hdev, HCI_DEV_SUSPEND);
1241 return 0;
1242}
1243EXPORT_SYMBOL(hci_suspend_dev);
1244
1245/* Resume HCI device */
1246int hci_resume_dev(struct hci_dev *hdev)
1247{
1248 hci_notify(hdev, HCI_DEV_RESUME);
1249 return 0;
1250}
1251EXPORT_SYMBOL(hci_resume_dev);
1252
76bca880
MH		 1253/* Receive frame from HCI drivers */
1254int hci_recv_frame(struct sk_buff *skb)
1255{
1256 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1257 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1258 && !test_bit(HCI_INIT, &hdev->flags))) {
1259 kfree_skb(skb);
1260 return -ENXIO;
1261 }
1262
1263 /* Incomming skb */
1264 bt_cb(skb)->incoming = 1;
1265
1266 /* Time stamp */
1267 __net_timestamp(skb);
1268
1269 /* Queue frame for rx task */
1270 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1271 tasklet_schedule(&hdev->rx_task);
1272
76bca880
MH		 1273 return 0;
1274}
1275EXPORT_SYMBOL(hci_recv_frame);
1276
33e882a5
SS		 1277static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1278 int count, __u8 index, gfp_t gfp_mask)
1279{
1280 int len = 0;
1281 int hlen = 0;
1282 int remain = count;
1283 struct sk_buff *skb;
1284 struct bt_skb_cb *scb;
1285
1286 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1287 index >= NUM_REASSEMBLY)
1288 return -EILSEQ;
1289
1290 skb = hdev->reassembly[index];
1291
1292 if (!skb) {
1293 switch (type) {
1294 case HCI_ACLDATA_PKT:
1295 len = HCI_MAX_FRAME_SIZE;
1296 hlen = HCI_ACL_HDR_SIZE;
1297 break;
1298 case HCI_EVENT_PKT:
1299 len = HCI_MAX_EVENT_SIZE;
1300 hlen = HCI_EVENT_HDR_SIZE;
1301 break;
1302 case HCI_SCODATA_PKT:
1303 len = HCI_MAX_SCO_SIZE;
1304 hlen = HCI_SCO_HDR_SIZE;
1305 break;
1306 }
1307
1308 skb = bt_skb_alloc(len, gfp_mask);
1309 if (!skb)
1310 return -ENOMEM;
1311
1312 scb = (void *) skb->cb;
1313 scb->expect = hlen;
1314 scb->pkt_type = type;
1315
1316 skb->dev = (void *) hdev;
1317 hdev->reassembly[index] = skb;
1318 }
1319
1320 while (count) {
1321 scb = (void *) skb->cb;
1322 len = min(scb->expect, (__u16)count);
1323
1324 memcpy(skb_put(skb, len), data, len);
1325
1326 count -= len;
1327 data += len;
1328 scb->expect -= len;
1329 remain = count;
1330
1331 switch (type) {
1332 case HCI_EVENT_PKT:
1333 if (skb->len == HCI_EVENT_HDR_SIZE) {
1334 struct hci_event_hdr *h = hci_event_hdr(skb);
1335 scb->expect = h->plen;
1336
1337 if (skb_tailroom(skb) < scb->expect) {
1338 kfree_skb(skb);
1339 hdev->reassembly[index] = NULL;
1340 return -ENOMEM;
1341 }
1342 }
1343 break;
1344
1345 case HCI_ACLDATA_PKT:
1346 if (skb->len == HCI_ACL_HDR_SIZE) {
1347 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1348 scb->expect = __le16_to_cpu(h->dlen);
1349
1350 if (skb_tailroom(skb) < scb->expect) {
1351 kfree_skb(skb);
1352 hdev->reassembly[index] = NULL;
1353 return -ENOMEM;
1354 }
1355 }
1356 break;
1357
1358 case HCI_SCODATA_PKT:
1359 if (skb->len == HCI_SCO_HDR_SIZE) {
1360 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1361 scb->expect = h->dlen;
1362
1363 if (skb_tailroom(skb) < scb->expect) {
1364 kfree_skb(skb);
1365 hdev->reassembly[index] = NULL;
1366 return -ENOMEM;
1367 }
1368 }
1369 break;
1370 }
1371
1372 if (scb->expect == 0) {
1373 /* Complete frame */
1374
1375 bt_cb(skb)->pkt_type = type;
1376 hci_recv_frame(skb);
1377
1378 hdev->reassembly[index] = NULL;
1379 return remain;
1380 }
1381 }
1382
1383 return remain;
1384}
1385
ef222013
MH		 1386int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1387{
f39a3c06
SS		 1388 int rem = 0;
1389
ef222013
MH		 1390 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1391 return -EILSEQ;
1392
da5f6c37 1393 while (count) {
f39a3c06
SS		 1394 rem = hci_reassembly(hdev, type, data, count,
1395 type - 1, GFP_ATOMIC);
1396 if (rem < 0)
1397 return rem;
ef222013 1398
f39a3c06
SS		 1399 data += (count - rem);
1400 count = rem;
da5f6c37 1401 };
ef222013 1402
f39a3c06 1403 return rem;
ef222013
MH		 1404}
1405EXPORT_SYMBOL(hci_recv_fragment);
1406
99811510
SS		 1407#define STREAM_REASSEMBLY 0
1408
1409int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1410{
1411 int type;
1412 int rem = 0;
1413
da5f6c37 1414 while (count) {
99811510
SS		 1415 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1416
1417 if (!skb) {
1418 struct { char type; } *pkt;
1419
1420 /* Start of the frame */
1421 pkt = data;
1422 type = pkt->type;
1423
1424 data++;
1425 count--;
1426 } else
1427 type = bt_cb(skb)->pkt_type;
1428
1429 rem = hci_reassembly(hdev, type, data,
1430 count, STREAM_REASSEMBLY, GFP_ATOMIC);
1431 if (rem < 0)
1432 return rem;
1433
1434 data += (count - rem);
1435 count = rem;
da5f6c37 1436 };
99811510
SS		 1437
1438 return rem;
1439}
1440EXPORT_SYMBOL(hci_recv_stream_fragment);
1441
1da177e4
LT		 1442/* ---- Interface to upper protocols ---- */
1443
1444/* Register/Unregister protocols.
1445 * hci_task_lock is used to ensure that no tasks are running. */
1446int hci_register_proto(struct hci_proto *hp)
1447{
1448 int err = 0;
1449
1450 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1451
1452 if (hp->id >= HCI_MAX_PROTO)
1453 return -EINVAL;
1454
1455 write_lock_bh(&hci_task_lock);
1456
1457 if (!hci_proto[hp->id])
1458 hci_proto[hp->id] = hp;
1459 else
1460 err = -EEXIST;
1461
1462 write_unlock_bh(&hci_task_lock);
1463
1464 return err;
1465}
1466EXPORT_SYMBOL(hci_register_proto);
1467
1468int hci_unregister_proto(struct hci_proto *hp)
1469{
1470 int err = 0;
1471
1472 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1473
1474 if (hp->id >= HCI_MAX_PROTO)
1475 return -EINVAL;
1476
1477 write_lock_bh(&hci_task_lock);
1478
1479 if (hci_proto[hp->id])
1480 hci_proto[hp->id] = NULL;
1481 else
1482 err = -ENOENT;
1483
1484 write_unlock_bh(&hci_task_lock);
1485
1486 return err;
1487}
1488EXPORT_SYMBOL(hci_unregister_proto);
1489
1490int hci_register_cb(struct hci_cb *cb)
1491{
1492 BT_DBG("%p name %s", cb, cb->name);
1493
1494 write_lock_bh(&hci_cb_list_lock);
1495 list_add(&cb->list, &hci_cb_list);
1496 write_unlock_bh(&hci_cb_list_lock);
1497
1498 return 0;
1499}
1500EXPORT_SYMBOL(hci_register_cb);
1501
1502int hci_unregister_cb(struct hci_cb *cb)
1503{
1504 BT_DBG("%p name %s", cb, cb->name);
1505
1506 write_lock_bh(&hci_cb_list_lock);
1507 list_del(&cb->list);
1508 write_unlock_bh(&hci_cb_list_lock);
1509
1510 return 0;
1511}
1512EXPORT_SYMBOL(hci_unregister_cb);
1513
1514static int hci_send_frame(struct sk_buff *skb)
1515{
1516 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1517
1518 if (!hdev) {
1519 kfree_skb(skb);
1520 return -ENODEV;
1521 }
1522
0d48d939 1523 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1524
1525 if (atomic_read(&hdev->promisc)) {
1526 /* Time stamp */
a61bbcf2 1527 __net_timestamp(skb);
1da177e4 1528
eec8d2bc 1529 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1530 }
1531
1532 /* Get rid of skb owner, prior to sending to the driver. */
1533 skb_orphan(skb);
1534
1535 return hdev->send(skb);
1536}
1537
1538/* Send HCI command */
a9de9248 1539int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1540{
1541 int len = HCI_COMMAND_HDR_SIZE + plen;
1542 struct hci_command_hdr *hdr;
1543 struct sk_buff *skb;
1544
a9de9248 1545 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1546
1547 skb = bt_skb_alloc(len, GFP_ATOMIC);
1548 if (!skb) {
ef222013 1549 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1550 return -ENOMEM;
1551 }
1552
1553 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1554 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1555 hdr->plen = plen;
1556
1557 if (plen)
1558 memcpy(skb_put(skb, plen), param, plen);
1559
1560 BT_DBG("skb len %d", skb->len);
1561
0d48d939 1562 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1563 skb->dev = (void *) hdev;
c78ae283 1564
a5040efa
JH		 1565 if (test_bit(HCI_INIT, &hdev->flags))
1566 hdev->init_last_cmd = opcode;
1567
1da177e4 1568 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1569 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1570
1571 return 0;
1572}
1da177e4
LT		 1573
1574/* Get data from the previously sent command */
a9de9248 1575void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1576{
1577 struct hci_command_hdr *hdr;
1578
1579 if (!hdev->sent_cmd)
1580 return NULL;
1581
1582 hdr = (void *) hdev->sent_cmd->data;
1583
a9de9248 1584 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1585 return NULL;
1586
a9de9248 1587 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1588
1589 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1590}
1591
1592/* Send ACL data */
1593static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1594{
1595 struct hci_acl_hdr *hdr;
1596 int len = skb->len;
1597
badff6d0
ACM		 1598 skb_push(skb, HCI_ACL_HDR_SIZE);
1599 skb_reset_transport_header(skb);
9c70220b 1600 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1601 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1602 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1603}
1604
9a9c6a34 1605void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1606{
1607 struct hci_dev *hdev = conn->hdev;
1608 struct sk_buff *list;
1609
1610 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1611
1612 skb->dev = (void *) hdev;
0d48d939 1613 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1614 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1615
70f23020
AE		 1616 list = skb_shinfo(skb)->frag_list;
1617 if (!list) {
1da177e4
LT		 1618 /* Non fragmented */
1619 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1620
1621 skb_queue_tail(&conn->data_q, skb);
1622 } else {
1623 /* Fragmented */
1624 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1625
1626 skb_shinfo(skb)->frag_list = NULL;
1627
1628 /* Queue all fragments atomically */
1629 spin_lock_bh(&conn->data_q.lock);
1630
1631 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 1632
1633 flags &= ~ACL_START;
1634 flags |= ACL_CONT;
1da177e4
LT		 1635 do {
1636 skb = list; list = list->next;
8e87d142 1637
1da177e4 1638 skb->dev = (void *) hdev;
0d48d939 1639 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1640 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1641
1642 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1643
1644 __skb_queue_tail(&conn->data_q, skb);
1645 } while (list);
1646
1647 spin_unlock_bh(&conn->data_q.lock);
1648 }
1649
c78ae283 1650 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1651}
1652EXPORT_SYMBOL(hci_send_acl);
1653
1654/* Send SCO data */
0d861d8b 1655void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 1656{
1657 struct hci_dev *hdev = conn->hdev;
1658 struct hci_sco_hdr hdr;
1659
1660 BT_DBG("%s len %d", hdev->name, skb->len);
1661
aca3192c 1662 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1663 hdr.dlen = skb->len;
1664
badff6d0
ACM		 1665 skb_push(skb, HCI_SCO_HDR_SIZE);
1666 skb_reset_transport_header(skb);
9c70220b 1667 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1668
1669 skb->dev = (void *) hdev;
0d48d939 1670 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 1671
1da177e4 1672 skb_queue_tail(&conn->data_q, skb);
c78ae283 1673 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1674}
1675EXPORT_SYMBOL(hci_send_sco);
1676
1677/* ---- HCI TX task (outgoing data) ---- */
1678
1679/* HCI Connection scheduler */
1680static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1681{
1682 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1683 struct hci_conn *conn = NULL;
1da177e4
LT		 1684 int num = 0, min = ~0;
1685 struct list_head *p;
1686
8e87d142 1687 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1688 * added and removed with TX task disabled. */
1689 list_for_each(p, &h->list) {
1690 struct hci_conn *c;
1691 c = list_entry(p, struct hci_conn, list);
1692
769be974 1693 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 1694 continue;
769be974
MH		 1695
1696 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1697 continue;
1698
1da177e4
LT		 1699 num++;
1700
1701 if (c->sent < min) {
1702 min = c->sent;
1703 conn = c;
1704 }
1705 }
1706
1707 if (conn) {
6ed58ec5
VT		 1708 int cnt, q;
1709
1710 switch (conn->type) {
1711 case ACL_LINK:
1712 cnt = hdev->acl_cnt;
1713 break;
1714 case SCO_LINK:
1715 case ESCO_LINK:
1716 cnt = hdev->sco_cnt;
1717 break;
1718 case LE_LINK:
1719 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
1720 break;
1721 default:
1722 cnt = 0;
1723 BT_ERR("Unknown link type");
1724 }
1725
1726 q = cnt / num;
1da177e4
LT		 1727 *quote = q ? q : 1;
1728 } else
1729 *quote = 0;
1730
1731 BT_DBG("conn %p quote %d", conn, *quote);
1732 return conn;
1733}
1734
bae1f5d9 1735static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 1736{
1737 struct hci_conn_hash *h = &hdev->conn_hash;
1738 struct list_head *p;
1739 struct hci_conn *c;
1740
bae1f5d9 1741 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 1742
1743 /* Kill stalled connections */
1744 list_for_each(p, &h->list) {
1745 c = list_entry(p, struct hci_conn, list);
bae1f5d9
VT		 1746 if (c->type == type && c->sent) {
1747 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 1748 hdev->name, batostr(&c->dst));
1749 hci_acl_disconn(c, 0x13);
1750 }
1751 }
1752}
1753
1754static inline void hci_sched_acl(struct hci_dev *hdev)
1755{
1756 struct hci_conn *conn;
1757 struct sk_buff *skb;
1758 int quote;
1759
1760 BT_DBG("%s", hdev->name);
1761
1762 if (!test_bit(HCI_RAW, &hdev->flags)) {
1763 /* ACL tx timeout must be longer than maximum
1764 * link supervision timeout (40.9 seconds) */
82453021 1765 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 1766 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 1767 }
1768
1769 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1770 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1771 BT_DBG("skb %p len %d", skb, skb->len);
04837f64
MH		 1772
1773 hci_conn_enter_active_mode(conn);
1774
1da177e4
LT		 1775 hci_send_frame(skb);
1776 hdev->acl_last_tx = jiffies;
1777
1778 hdev->acl_cnt--;
1779 conn->sent++;
1780 }
1781 }
1782}
1783
1784/* Schedule SCO */
1785static inline void hci_sched_sco(struct hci_dev *hdev)
1786{
1787 struct hci_conn *conn;
1788 struct sk_buff *skb;
1789 int quote;
1790
1791 BT_DBG("%s", hdev->name);
1792
1793 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1794 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1795 BT_DBG("skb %p len %d", skb, skb->len);
1796 hci_send_frame(skb);
1797
1798 conn->sent++;
1799 if (conn->sent == ~0)
1800 conn->sent = 0;
1801 }
1802 }
1803}
1804
b6a0dc82
MH		 1805static inline void hci_sched_esco(struct hci_dev *hdev)
1806{
1807 struct hci_conn *conn;
1808 struct sk_buff *skb;
1809 int quote;
1810
1811 BT_DBG("%s", hdev->name);
1812
1813 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1814 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1815 BT_DBG("skb %p len %d", skb, skb->len);
1816 hci_send_frame(skb);
1817
1818 conn->sent++;
1819 if (conn->sent == ~0)
1820 conn->sent = 0;
1821 }
1822 }
1823}
1824
6ed58ec5
VT		 1825static inline void hci_sched_le(struct hci_dev *hdev)
1826{
1827 struct hci_conn *conn;
1828 struct sk_buff *skb;
1829 int quote, cnt;
1830
1831 BT_DBG("%s", hdev->name);
1832
1833 if (!test_bit(HCI_RAW, &hdev->flags)) {
1834 /* LE tx timeout must be longer than maximum
1835 * link supervision timeout (40.9 seconds) */
bae1f5d9 1836 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 1837 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 1838 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 1839 }
1840
1841 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1842 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
1843 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1844 BT_DBG("skb %p len %d", skb, skb->len);
1845
1846 hci_send_frame(skb);
1847 hdev->le_last_tx = jiffies;
1848
1849 cnt--;
1850 conn->sent++;
1851 }
1852 }
1853 if (hdev->le_pkts)
1854 hdev->le_cnt = cnt;
1855 else
1856 hdev->acl_cnt = cnt;
1857}
1858
1da177e4
LT		 1859static void hci_tx_task(unsigned long arg)
1860{
1861 struct hci_dev *hdev = (struct hci_dev *) arg;
1862 struct sk_buff *skb;
1863
1864 read_lock(&hci_task_lock);
1865
6ed58ec5
VT		 1866 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
1867 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 1868
1869 /* Schedule queues and send stuff to HCI driver */
1870
1871 hci_sched_acl(hdev);
1872
1873 hci_sched_sco(hdev);
1874
b6a0dc82
MH		 1875 hci_sched_esco(hdev);
1876
6ed58ec5
VT		 1877 hci_sched_le(hdev);
1878
1da177e4
LT		 1879 /* Send next queued raw (unknown type) packet */
1880 while ((skb = skb_dequeue(&hdev->raw_q)))
1881 hci_send_frame(skb);
1882
1883 read_unlock(&hci_task_lock);
1884}
1885
1886/* ----- HCI RX task (incoming data proccessing) ----- */
1887
1888/* ACL data packet */
1889static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1890{
1891 struct hci_acl_hdr *hdr = (void *) skb->data;
1892 struct hci_conn *conn;
1893 __u16 handle, flags;
1894
1895 skb_pull(skb, HCI_ACL_HDR_SIZE);
1896
1897 handle = __le16_to_cpu(hdr->handle);
1898 flags = hci_flags(handle);
1899 handle = hci_handle(handle);
1900
1901 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1902
1903 hdev->stat.acl_rx++;
1904
1905 hci_dev_lock(hdev);
1906 conn = hci_conn_hash_lookup_handle(hdev, handle);
1907 hci_dev_unlock(hdev);
8e87d142 1908
1da177e4
LT		 1909 if (conn) {
1910 register struct hci_proto *hp;
1911
04837f64
MH		 1912 hci_conn_enter_active_mode(conn);
1913
1da177e4 1914 /* Send to upper protocol */
70f23020
AE		 1915 hp = hci_proto[HCI_PROTO_L2CAP];
1916 if (hp && hp->recv_acldata) {
1da177e4
LT		 1917 hp->recv_acldata(conn, skb, flags);
1918 return;
1919 }
1920 } else {
8e87d142 1921 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 1922 hdev->name, handle);
1923 }
1924
1925 kfree_skb(skb);
1926}
1927
1928/* SCO data packet */
1929static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1930{
1931 struct hci_sco_hdr *hdr = (void *) skb->data;
1932 struct hci_conn *conn;
1933 __u16 handle;
1934
1935 skb_pull(skb, HCI_SCO_HDR_SIZE);
1936
1937 handle = __le16_to_cpu(hdr->handle);
1938
1939 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1940
1941 hdev->stat.sco_rx++;
1942
1943 hci_dev_lock(hdev);
1944 conn = hci_conn_hash_lookup_handle(hdev, handle);
1945 hci_dev_unlock(hdev);
1946
1947 if (conn) {
1948 register struct hci_proto *hp;
1949
1950 /* Send to upper protocol */
70f23020
AE		 1951 hp = hci_proto[HCI_PROTO_SCO];
1952 if (hp && hp->recv_scodata) {
1da177e4
LT		 1953 hp->recv_scodata(conn, skb);
1954 return;
1955 }
1956 } else {
8e87d142 1957 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 1958 hdev->name, handle);
1959 }
1960
1961 kfree_skb(skb);
1962}
1963
6516455d 1964static void hci_rx_task(unsigned long arg)
1da177e4
LT		 1965{
1966 struct hci_dev *hdev = (struct hci_dev *) arg;
1967 struct sk_buff *skb;
1968
1969 BT_DBG("%s", hdev->name);
1970
1971 read_lock(&hci_task_lock);
1972
1973 while ((skb = skb_dequeue(&hdev->rx_q))) {
1974 if (atomic_read(&hdev->promisc)) {
1975 /* Send copy to the sockets */
eec8d2bc 1976 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1977 }
1978
1979 if (test_bit(HCI_RAW, &hdev->flags)) {
1980 kfree_skb(skb);
1981 continue;
1982 }
1983
1984 if (test_bit(HCI_INIT, &hdev->flags)) {
1985 /* Don't process data packets in this states. */
0d48d939 1986 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1987 case HCI_ACLDATA_PKT:
1988 case HCI_SCODATA_PKT:
1989 kfree_skb(skb);
1990 continue;
3ff50b79 1991 }
1da177e4
LT		 1992 }
1993
1994 /* Process frame */
0d48d939 1995 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1996 case HCI_EVENT_PKT:
1997 hci_event_packet(hdev, skb);
1998 break;
1999
2000 case HCI_ACLDATA_PKT:
2001 BT_DBG("%s ACL data packet", hdev->name);
2002 hci_acldata_packet(hdev, skb);
2003 break;
2004
2005 case HCI_SCODATA_PKT:
2006 BT_DBG("%s SCO data packet", hdev->name);
2007 hci_scodata_packet(hdev, skb);
2008 break;
2009
2010 default:
2011 kfree_skb(skb);
2012 break;
2013 }
2014 }
2015
2016 read_unlock(&hci_task_lock);
2017}
2018
2019static void hci_cmd_task(unsigned long arg)
2020{
2021 struct hci_dev *hdev = (struct hci_dev *) arg;
2022 struct sk_buff *skb;
2023
2024 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2025
1da177e4 2026 /* Send queued commands */
5a08ecce
AE		 2027 if (atomic_read(&hdev->cmd_cnt)) {
2028 skb = skb_dequeue(&hdev->cmd_q);
2029 if (!skb)
2030 return;
2031
7585b97a 2032 kfree_skb(hdev->sent_cmd);
1da177e4 2033
70f23020
AE		 2034 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2035 if (hdev->sent_cmd) {
1da177e4
LT		 2036 atomic_dec(&hdev->cmd_cnt);
2037 hci_send_frame(skb);
6bd32326
VT		 2038 mod_timer(&hdev->cmd_timer,
2039 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2040 } else {
2041 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2042 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2043 }
2044 }
2045}
kernel source for telekom puls (alcatel/mediatek)